Design and Implementation of a Real-Time Multi-Vector DDoS Detection and Prevention Framework Using ML-Ready Detection Logic and nftables

Abstract

This paper presents the design and implementation of a real-time, multi-vector DDoS detection and prevention framework for cloud environments. The system integrates machine-learning–ready anomaly detection logic with nftables for automated mitigation and uses Redis as a message bus for synchronous alert communication. The framework was tested using Apache Bench and hping3 to simulate multiple DDoS attacks, including SYN flood, UDP flood, HTTP GET flood, and ICMP flood. Experimental results demonstrated that the proposed system effectively restores near-normal throughput and response times under attack conditions. Specifically, throughput recovery averaged 92.7%, failed requests decreased by 91.4%, and latency improved by 96.4% across attack types. Comparative analysis with existing DDoS mitigation techniques revealed higher Threat classification correctness and adaptability. The proposed hybrid ML nftables design provides a scalable, efficient, and deployable approach for defending cloud infrastructures against evolving multi-vector DDoS threats.